19. One should focus on measuring risk to the business as opposed to implementation of policies and control when tying policy adherence to performance measurement. Is this to be true or false? Explain. 20. One of the basic measurements for assessing whether or not individuals are being held accountable for adherence to security policies is the reported number of security violations by employees. You should investigate any unexplained increases in reported violations to determine why an abnormal number is occurring. Is this to be true or false? Explain.